CVE-2026-31556

Vulnerability

Overview

In the Linux kernel's XFS filesystem, the xchk_quota_item function in the scrub subsystem has a missing unlock bug. When xchk_fblock_process_error returns false, the function can return early without dropping dq->q_qlock. This leaves the dquot lock acquired, which can lead to lock leaks or deadlocks in subsequent quota operations.

Exploitation

Context

This is a local vulnerability that can be triggered by a user with sufficient privileges to initiate XFS scrub operations on a filesystem that uses quota. The attacker does not need network access. The bug lies in the error handling path within the quota scrub code. By causing a specific error condition during scrub, the lock can be left held, potentially causing a denial of service due to deadlock or lock contention.

Impact

An attacker could exploit this to cause a deadlock in the kernel, preventing further quota operations and potentially affecting overall system stability. The CVSS v3 base score is 5.5 (Medium), reflecting the local attack vector and the availability impact. There is no evidence of remote exploitation or privilege escalation beyond the immediate denial of service.

Mitigation

The fix, which adds the missing unlock before the early return, has been committed to the Linux kernel stable tree. Users should apply the corresponding stable kernel updates that include this commit. The references [1], [2], [3], [4] point to the fix commits for different stable branches. No workaround other than patching is mentioned.